Squid blocks traffic to authenticated users

[senseivita]

I'm trying to setup a proxy accessible over the Internet. I set it up locally with WPAD, adding the whole 10.* class A to cover all of my subnets and it worked fine so far.

Next, I set it up to authenticate using the local FreeRADIUS server (before switching to DCs), added test users, opened the ports and wished for the best. It asked me for authentication, it accepted it, but it won't pass traffic.

I get 403s and 407s: Forbidden and Proxy Authentication Required according to a quick Wikipedia lookup.

To allow traffic to the proxy I'm not port forwarding--just opened the firewall ports (3128 & 3129) and selected the public interfaces in Squid so it listens there too.

What am I missing?

Thanks!